Have you ever seen websites that have pure sql statements in their url?
eg

http://www.samplesite.com/sql=Select+something+something+from+tablename+where+columnname=something

This I just saw on a major nigerian financial institution client login page. and basically if you change the statement to something like this


http://www.samplesite.com/sql=Select+something+something+from+tablename+where+columnname>1

You will get all the information of their customers.

I was wondering, a major financial institution is it that they are not aware of these simple details?   Someone please help me put my head around this.

I am not talking about a small financial organization o. I am talking major.

This is another one from my previous post. That has been fixed.

i think the question will be more appropriate to the database admin n not the coy,


@ur question: probably, it's not known

Well, this is a developer's issue that is if their dba and programmers are different. Architecture planning, all tlhese issues must have been addresses. The main pages are password protected, But pages loading via javascripts are not password protected. I dont knowif they were thinking that protecting the parent page will protect others and left the security for the children.

From what I have seen, do Nigerian companies go tru system reviews after initial deployment? The major companies I have seen so far, after the first deployment, no reviews are done just keep adding to it.

dude, our banks are nothing to write about.
just email them, and do it wisely.

can i add u on FB @Cactus

Cactus:

Have you ever seen websites that have pure sql statements in their url?
eg

http://www.samplesite.com/sql=Select+something+something+from+tablename+where+columnname=something

This I just saw on a major nigerian financial institution client login page. and basically if you change the statement to something like this


http://www.samplesite.com/sql=Select+something+something+from+tablename+where+columnname>1

You will get all the information of their customers.

I was wondering, a major financial institution is it that they are not aware of these simple details?   Someone please help me put my head around this.

I am not talking about a small financial organization o. I am talking major.

This is another one from my previous post. That has been fixed.